← Database
CVE-2021-3849
CRITICAL
CVSS: 9.8
Published: 2022-04-22
Modified: 2026-06-17
Description
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
Affected Platforms
Ibm Nextscale Fan Power Controller FirmwareLenovo Nextscale N1200 Enclosure FirmwareLenovo Thinkagile Hx Enclosure Certified NodeLenovo Thinkagile Hx Enclosure Certified Node FirmwareLenovo Thinksystem D2 EnclosureLenovo Thinkagile Vx EnclosureLenovo Nextscale N1200 EnclosureLenovo Thinksystem D2 Enclosure FirmwareIbm Nextscale Fan Power ControllerLenovo Thinkagile Vx Enclosure Firmware
Weakness Type
CWE-288, NVD-CWE-noinfo